Preserving confidentiality in occupational medical practice

Author: Robert J. McCunney
Date: April, 1996

The physician's challenge in preserving medical confidentiality derives primarily from his or her position between patients on the one side and businesses, regulatory agencies and insurance carriers on the other side, each of whom have a vested interest in patients' medical information. In providing occupational medical services, the family physician is faced with requests for confidential information from a variety of sources.[1,2] Despite the lack of a uniform national law regarding medical confidentiality, various codes of conduct and relevant parts of the Americans with Disabilities Act (ADA) of 1992 can help physicians make informed decisions about requests for medical information. In all codes of conduct, the patient decides whether and when to release such material, unless overruled by public health risks or laws. This article provides a framework for response to requests for information by reviewing several codes of conduct and legislation affecting confidential medical information and applying them to five clinical care situations.

Laws and Regulations

Federal statutory law relating to medical confidentiality includes more than 40 references in the United States Code addressing the medical records of veterans administration hospitals, the armed services and federal research protocols.

The federal Privacy Act of 1974, which provides protection from inappropriate disclosure by governmental agencies, pertains to hospitals operated by the federal government and to private health care or research operations with government contracts.

The ADA allows business managers to be informed of work restrictions and corresponding accommodations; these personnel, however, are not entitled to receive specific diagnostic information,[3] although first-aid and safety professionals at the workplace may be informed if the disability might require emergency treatment. Notable examples are employees with insulin-dependent diabetes or unstable epilepsy, or conditions in which emergency treatment can be life-saving. Medical records should be separated from personnel records. The ADA recommends that access to the medical records be limited but does not state that such access be limited to qualified medical personnel.[4]

Urine drug testing is not a medical examination in the context of ADA provisions and, as a result, the examining physician can release the results if the job applicant signs an appropriate release. If, in the course of this testing, a physician discovers proper use of a prescription medication, such information is considered confidential. On the other hand, alcohol testing is considered a medical examination and is subject to more extensive confidentiality provisions than those governing the use of illegal drugs.[5] Government officials who investigate compliance with ADA may be provided with relevant medical information (including medical records) on request.

Codes of Conduct

Codes of conduct relating to the essentially privileged nature of health-related information - especially communication between healer and patient - go back to antiquity. The code of Hammurabi[6] and the oath of Hippocrates address the importance of protecting confidentiality in the therapeutic context. The American Medical Association,[7] the American College of Occupational and Environmental Medicine[8] and the International Commission of Occupational Health[9] have specifically addressed the protection of medical confidentiality in the provision of occupational medical services (Table 1).



An orthopedic surgeon cuts herself during a procedure on a man considered to be in a group at high risk for human immunodeficiency virus (HIV) infection. The surgeon wants to find out the patient's HIV status before considering prophylactic treatment for herself, but the patient refuses to allow testing for HIV.

What options are available to the surgeon?

Needle-stick injuries, especially in hospital settings, present serious clinical challenges. In this case, the surgeon was convinced that she had been exposed to the blood of a person in a group at high risk for HIV infection. Although its effectiveness is controversial, zidovudine (Retrovir), administered within the first 24 hours of exposure to HIV, may thwart infection. The orthopedic surgeon wanted to know the patient's HIV status so she could make an informed decision about taking zidovudine, especially in light of the drug's side effects, such as drowsiness, headaches and impaired concentration.

Her dilemma can be addressed in part by the OSHA Bloodborne Pathogen Standard, which states "the source individual's blood shall be tested as soon as feasible and after consent is obtained in order to determine HBV and HIV infectivity. If consent is not obtained, the employer shall establish that legally required consent cannot be obtained. When the source individual's consent is not required by law, the source individual's blood, if available, shall be tested, and the results documented."[11]

One interpretation of this standard suggests that if blood was drawn before surgery for another purpose, it can be analyzed for HIV, even in the face of the surgical patient's objections. Some states, however, prohibit such testing without the informed consent of the person who gave the specimen. This provision of the OSHA Bloodborne Pathogen Standard raises other interesting challenges: What if the results of a blood test prove positive for HIV, but the person had refused authorization for testing? Should the person be informed of the positive test result and, if so, how?

HIV testing presents a unique set of confidentiality concerns and has been specifically addressed by the Council on Ethical and judicial Affairs of the AMA, as follows: "Physicians should ensure that HIV testing is conducted in a way that respects patient autonomy and assures patient confidentiality as much as possible. The physician should secure the patient's informed consent specific for HIV testing before testing is performed."[7]

A related federal measure, the Ryan White Care Act of 1994, addresses the exposure of emergency responders, such as police and fire fighters, to people with potentially infectious diseases - airborne or bloodborne. Only airborne diseases, however, are subject to mandatory notification.


A 23-year-old man with shortness of breath associated with spray painting presents for an evaluation.

What information, can the physician obtain from the employer? What can the physician tell the employer?

When a patient presents with symptoms that may be related to work, a number of options are available to the physician for gaining information. Frameworks for deciding what information should be released to the employer are provided by codes of ethical conduct, the OSHA Hazard Communication Standard,[12] the ADA,[3] and the OSHA Access to Employee Exposure and Medical Records Standard.[13]

The OSHA Access to Employee Exposure and Medical Records Standard "applies to all employee exposure medical records and analyses thereof, made or maintained in any manner, including an in-house or contractual basis."[13] Records must be provided by the employer within 15 days of request to all employees who are exposed to toxic substances or harmful physical agents. Although the definition of a medical record may vary, the OSHA Access to Employee Exposure and Medical Records Standard states that the following information is included: medical questionnaires, results of examinations and tests, progress notes and health insurance records that can be identified with a personal marker. Exemptions from the medical record include physical specimens, and alcohol and drug abuse records, if they are maintained separately from the routine chart.

The OSHA Access to Employee Exposure and Medical Records Standard pertains only to employees exposed to toxic substances and their corresponding exposure and medical records. The physician representing the employer may talk with the treating physician or with the patient who requested medical records. The physician representing the employer may allow only selective information to be communicated to protect the release of information that may have an unfavorable effect on the patient.

In this case, the treating physician can obtain exposure monitoring data and/or medical surveillance reports in addition to material safety data sheets covering the chemicals used in the workplace. For example, this material may aid in the evaluation of possible asthma. If occupational asthma is diagnosed, a decision must be made, under the ADA, as to whether the patient should return to the original job - with or without accommodations - or whether the illness now constitutes a direct threat to self or others (Table 2).


In the performance of a medical surveillance examination, a physician finds that a hazardous waste worker has liver function abnormalities.

What information can the physician request from the employer? What information should the physician release to the employer?

In screening for occupational illness, false-positive evaluations are inevitable. Medical surveillance of hazardous waste workers is further complicated by the range of hazards to which workers may be exposed. Liver function tests are affected by many factors, such as alcohol ingestion, medications and infections, as well as exposure to toxic substances.[14]

In this case, the OSHA Access to Employee Exposure and Medical Records Standard is most helpful. If a work-related injury or illness or other occupational abnormality is noted in a medical surveillance examination, the employer should be informed. If the patient's liver function abnormalities are the result of alcohol use, previous hepatitis infection, medications or some other factor, the employer should not be informed. If the liver function abnormalities are permanent and reflective of a nonoccupational hepatic disorder, however, the decision then has to be made as to whether exposure to hepatotoxins at the workplace poses a direct threat under the ADA.


A maintenance worker is found somnolent in a machine shop. His supervisor sends him for a fitness evaluation and demands a urine drug test.

What information can the employer be given?

Fitness evaluations are used widely in many safety-sensitive work settings, especially the nuclear, chemical and transportation industries. In this case, the employee worked at a company with a well-developed drug testing policy approved by labor and management. When the employee's urine drug test proved to be positive for cocaine, the employee asked the health facility whether the name of the drug would be released to the employer. According to Department of Transportation regulations, the employer can be told the name of the specific drug but not the quantity of the drug found.[15]

Final Comment

A fair amount of misunderstanding about medical confidentiality exists among physicians, other health care professionals and business personnel. Difficulties in understanding can occur in many settings, especially when the same medical record is used for both occupational disorders and general health ailments. Electronic health care delivery systems offer appealing advantages of efficiency that must be tempered with awareness of the corresponding potential for misuse of health information.

Despite the disparity in laws and the lack of national guidelines, the codes of ethical practice of professional organizations serve as respected frameworks for clinical decision-making and court proceedings. The accountability of third parties with regard to confidentiality is unclear. A recent review[16] noted little or no regulation governing the informational practices of insurers.[17] In many states, the "legal duties of physicians to safeguard patient confidences do not extend to other health care professionals, researchers or health care institutions, even though the risk of harm from disclosure may be as great or greater."[18]

To establish trust in the therapeutic relationship, people should be informed about the disposition of their medical information, including its storage, custody and access. Ideally, access to medical records should be limited to medical professionals and their representatives, a point not made in the ADA.

Unfortunately, the protection of private medical information may not be fully achievable.[19] In some settings, it may be more appropriate to simply "put the pen down and listen," without writing sensitive information that has the potential for misuse. Physicians are advised to be attentive to detail in responding to requests for medical information and to avoid the tendency to send general information when worker's compensation data or other specific information is requested.


[1.] Skolnick AA. Protecting privacy of computerized patient information may lie in the cards. JAMA 1994;272:187-9. [2.] McCunney RJ, Brandt-Rauf P. Ethical conflict in the private practice of occupational medicine. J Occup Med 1991;33:80-2. [3.] Equal employment opportunity for individuals with disabilities - EEOC. Final rule. Fed Regist 1991;56:35726-53. [4.] St. Clair S, Shults T. Americans with Disabilities Act. Considerations for the practice of occupational medicine. J Occup Med 1992;34:510-7. [5.] Rischitelli DG. Avoiding discriminatory drug testing practices under the Americans with Disabilities Act. J Leg Med 1993;14:597-615. [6.] Code of medical ethics: current opinions with annotations, including the principles of medical ethics, fundamental elements of the patient-physician relationship and rules of the Council on Ethical and judicial Affairs. Chicago: American Medical Association, 1994. [7.] Code of medical ethics, annotated current opinions including the principles of medical ethics, fundamental elements of the patient-physician relationship, and rules of the Council on Ethical and Judicial Affairs. Chicago: American Medical Association, 1992. [8.] Code of ethical conduct. American College of Occupational and Environmental Medicine. J Occup Med 1994;36:27-30. [9.] International Commission of Occupational Health. International code of ethics for occupational health professionals. Singapore: National University Hospital, 1992. [10.] McCunney RJ. Occupational medical services. In: McCunney RJ, ed. A practical approach to occupational and environmental medicine. 2d ed. Boston: Little, Brown, 1994. [11.] Occupational exposure to bloodborne pathogens: final rule issued by the Occupational Safety and Health Administration, Dec. 6, 1991 (29 CFR 1910. 1030). Chicago: Commerce Clearing House, 1991. [12.] Inspection procedures for the hazard communication standard (29 CFR 1910.1200). Washington, D.C.: Department of Labor, Occupational Safety and Health Administration, 1986. [13.] OSHA Standards. Access to Employee Exposure and Medical Records (29 CFR 1910.20). [14.] Harber P, McCunney RJ, Monosson I. Medical surveillance. In: McCunney RJ, ed. A practical approach to occupational and environmental medicine. Boston: Little, Brown, 1994. [15.] Procedures for transportation workplace drug and alcohol testing programs. Fed Regist 1994;59:1302-7625. [16.] Gostin, LO, Turek-Brezina J, Powers M, Kozloff R, Faden R, Steinauer DD. Privacy and security of personal information in a new health care system. JAMA 1993;270:2487-93. [17.] Trubow GB. Privacy law and practice. New York: Matthew Binder, 1987:sect. 801. [18.] Public health protection and the privacy of medical records. Harvard Law Review 1981:265. [19.] Council on Ethical and judicial Affairs, American Medical Association. Ethical issues in health care system reform. The provision of adequate health care. JAMA 1994;272:1056-62.

The Author

ROBERT J. MCCUNNEY, M.D., M.S., M.P.H. is director of the Environmental Medical Service in the Medical Department at the Massachusetts Institute of Technology, where he oversees occupational medicine, biological safety, industrial hygiene and radiation protection. Dr. McCunney completed a master's degree in environmental health at the University of Minnesota Medical School, Minneapolis, and earned a medical degree from Jefferson Medical College of Thomas Jefferson University, Philadelphia. He completed a residency in internal medicine at Northwestern University Medical Center, Chicago, and earned a master of public health degree at Harvard University School of Public Health, Boston.

Address correspondence to Robert J. McCunney, M.D., M.S., M.P.H., Environmental Medicine Service, Massachusetts Institute of Technology, 77 Massachusetts Ave., Suite 20B-238, Cambridge, MA 02139-4307.

COPYRIGHT 1996 American Academy of Family PhysiciansCOPYRIGHT 2004 Gale Group

© 2006,, All Rights Reserved.